v2.4.0 — OIDC login, OpenStreetMap search, account management

Features: - Single Sign-On (OIDC) — login with Google, Apple, Authentik, Keycloak - OpenStreetMap place search as free fallback when no Google API key - Change password in user settings - Delete own account (with last-admin protection) - Last login column in admin user management - SSO badge and provider info in user settings - Google API key "Recommended" badge in admin panel Improvements: - API keys load correctly after page reload - Validate auto-saves keys before testing - Time format respects 12h/24h setting everywhere - Dark mode fixes for popups and backup buttons - Admin stats: removed photos, 4-column layout - Profile picture upload button on avatar overlay - TravelStats duplicate key fix - Backup panel dark mode support
2026-03-19 23:49:07 +01:00
parent 74be63555d
commit c887acddee
21 changed files with 779 additions and 97 deletions
--- a/README.md
+++ b/README.md
@@ -28,7 +28,8 @@ A self-hosted, real-time collaborative travel planner for organizing trips with

 - **Real-Time Collaboration** — Plan together via WebSocket live sync — changes appear instantly across all connected users
 - **Interactive Map** — Leaflet map with marker clustering, route visualization, and customizable tile sources
- **Google Places Integration** — Search places, auto-fill details including ratings, reviews, opening hours, and photos (requires API key)
+- **Place Search** — Search via Google Places (with photos, ratings, opening hours) or OpenStreetMap (free, no API key needed)
+- **Single Sign-On (OIDC)** — Login with Google, Apple, Authentik, Keycloak, or any OIDC provider
 - **Drag & Drop Planner** — Organize places into day plans with reordering and cross-day moves
 - **Weather Forecasts** — Current weather and 5-day forecasts with smart caching (requires API key)
 - **Budget Tracking** — Category-based expenses with pie chart, per-person/per-day splitting, and multi-currency support
--- a/client/src/App.jsx
+++ b/client/src/App.jsx
@@ -55,7 +55,7 @@ function RootRedirect() {
 }

 export default function App() {
-  const { loadUser, token, isAuthenticated, demoMode, setDemoMode } = useAuthStore()
+  const { loadUser, token, isAuthenticated, demoMode, setDemoMode, setHasMapsKey } = useAuthStore()
  const { loadSettings } = useSettingsStore()

  useEffect(() => {
@@ -64,6 +64,7 @@ export default function App() {
    }
    authApi.getAppConfig().then(config => {
      if (config?.demo_mode) setDemoMode(true)
+      if (config?.has_maps_key !== undefined) setHasMapsKey(config.has_maps_key)
    }).catch(() => {})
  }, [])

--- a/client/src/api/client.js
+++ b/client/src/api/client.js
@@ -53,6 +53,8 @@ export const authApi = {
  updateAppSettings: (data) => apiClient.put('/auth/app-settings', data).then(r => r.data),
  validateKeys: () => apiClient.get('/auth/validate-keys').then(r => r.data),
  travelStats: () => apiClient.get('/auth/travel-stats').then(r => r.data),
+  changePassword: (data) => apiClient.put('/auth/me/password', data).then(r => r.data),
+  deleteOwnAccount: () => apiClient.delete('/auth/me').then(r => r.data),
  demoLogin: () => apiClient.post('/auth/demo-login').then(r => r.data),
 }

@@ -123,6 +125,8 @@ export const adminApi = {
  deleteUser: (id) => apiClient.delete(`/admin/users/${id}`).then(r => r.data),
  stats: () => apiClient.get('/admin/stats').then(r => r.data),
  saveDemoBaseline: () => apiClient.post('/admin/save-demo-baseline').then(r => r.data),
+  getOidc: () => apiClient.get('/admin/oidc').then(r => r.data),
+  updateOidc: (data) => apiClient.put('/admin/oidc', data).then(r => r.data),
 }

 export const mapsApi = {
--- a/client/src/components/Admin/BackupPanel.jsx
+++ b/client/src/components/Admin/BackupPanel.jsx
@@ -191,7 +191,7 @@ export default function BackupPanel() {
            <button
              onClick={handleCreate}
              disabled={isCreating}
-              className="flex items-center gap-2 bg-slate-700 text-white px-4 py-2 rounded-lg hover:bg-slate-900 text-sm font-medium disabled:opacity-60"
+              className="flex items-center gap-2 bg-slate-900 dark:bg-slate-100 text-white dark:text-slate-900 px-4 py-2 rounded-lg hover:bg-slate-900 text-sm font-medium disabled:opacity-60"
            >
              {isCreating ? (
                <div className="w-4 h-4 border-2 border-white border-t-transparent rounded-full animate-spin" />
@@ -289,7 +289,7 @@ export default function BackupPanel() {
            </div>
            <button
              onClick={() => handleAutoSettingsChange('enabled', !autoSettings.enabled)}
-              className={`relative inline-flex h-6 w-11 items-center rounded-full transition-colors ${autoSettings.enabled ? 'bg-slate-700' : 'bg-gray-200'}`}
+              className={`relative inline-flex h-6 w-11 items-center rounded-full transition-colors ${autoSettings.enabled ? 'bg-slate-900 dark:bg-slate-100' : 'bg-gray-200 dark:bg-gray-600'}`}
            >
              <span className={`inline-block h-4 w-4 transform rounded-full bg-white shadow transition-transform ${autoSettings.enabled ? 'translate-x-6' : 'translate-x-1'}`} />
            </button>
@@ -307,7 +307,7 @@ export default function BackupPanel() {
                      onClick={() => handleAutoSettingsChange('interval', opt.value)}
                      className={`px-4 py-2 rounded-lg text-sm font-medium border transition-colors ${
                        autoSettings.interval === opt.value
-                          ? 'bg-slate-700 text-white border-slate-700'
+                          ? 'bg-slate-900 dark:bg-slate-100 text-white dark:text-slate-900 border-slate-700'
                          : 'bg-white text-gray-600 border-gray-200 hover:border-gray-300'
                      }`}
                    >
@@ -327,7 +327,7 @@ export default function BackupPanel() {
                      onClick={() => handleAutoSettingsChange('keep_days', opt.value)}
                      className={`px-4 py-2 rounded-lg text-sm font-medium border transition-colors ${
                        autoSettings.keep_days === opt.value
-                          ? 'bg-slate-700 text-white border-slate-700'
+                          ? 'bg-slate-900 dark:bg-slate-100 text-white dark:text-slate-900 border-slate-700'
                          : 'bg-white text-gray-600 border-gray-200 hover:border-gray-300'
                      }`}
                    >
@@ -344,7 +344,7 @@ export default function BackupPanel() {
            <button
              onClick={handleSaveAutoSettings}
              disabled={autoSettingsSaving || !autoSettingsDirty}
-              className="flex items-center gap-2 bg-slate-700 text-white px-5 py-2 rounded-lg hover:bg-slate-900 text-sm font-medium disabled:opacity-50 transition-colors"
+              className="flex items-center gap-2 bg-slate-900 dark:bg-slate-100 text-white dark:text-slate-900 px-5 py-2 rounded-lg hover:bg-slate-900 text-sm font-medium disabled:opacity-50 transition-colors"
            >
              {autoSettingsSaving
                ? <div className="w-4 h-4 border-2 border-white border-t-transparent rounded-full animate-spin" />
--- a/client/src/components/Dashboard/TravelStats.jsx
+++ b/client/src/components/Dashboard/TravelStats.jsx
@@ -5,7 +5,7 @@ import { useTranslation } from '../../i18n'
 import { useSettingsStore } from '../../store/settingsStore'

 // Numeric ISO → country name lookup (countries-110m uses numeric IDs)
-const NUMERIC_TO_NAME = {"004":"Afghanistan","008":"Albania","012":"Algeria","024":"Angola","032":"Argentina","036":"Australia","040":"Austria","050":"Bangladesh","056":"Belgium","064":"Bhutan","068":"Bolivia","070":"Bosnia and Herzegovina","072":"Botswana","076":"Brazil","100":"Bulgaria","104":"Myanmar","108":"Burundi","112":"Belarus","116":"Cambodia","120":"Cameroon","124":"Canada","140":"Central African Republic","144":"Sri Lanka","148":"Chad","152":"Chile","156":"China","170":"Colombia","178":"Congo","180":"Democratic Republic of the Congo","188":"Costa Rica","191":"Croatia","192":"Cuba","196":"Cyprus","203":"Czech Republic","204":"Benin","208":"Denmark","214":"Dominican Republic","218":"Ecuador","818":"Egypt","222":"El Salvador","226":"Equatorial Guinea","232":"Eritrea","233":"Estonia","231":"Ethiopia","238":"Falkland Islands","246":"Finland","250":"France","266":"Gabon","270":"Gambia","268":"Georgia","276":"Germany","288":"Ghana","300":"Greece","320":"Guatemala","324":"Guinea","328":"Guyana","332":"Haiti","340":"Honduras","348":"Hungary","352":"Iceland","356":"India","360":"Indonesia","364":"Iran","368":"Iraq","372":"Ireland","376":"Israel","380":"Italy","384":"Ivory Coast","388":"Jamaica","392":"Japan","400":"Jordan","398":"Kazakhstan","404":"Kenya","408":"North Korea","410":"South Korea","414":"Kuwait","417":"Kyrgyzstan","418":"Laos","422":"Lebanon","426":"Lesotho","430":"Liberia","434":"Libya","440":"Lithuania","442":"Luxembourg","450":"Madagascar","454":"Malawi","458":"Malaysia","466":"Mali","478":"Mauritania","484":"Mexico","496":"Mongolia","498":"Moldova","504":"Morocco","508":"Mozambique","516":"Namibia","524":"Nepal","528":"Netherlands","540":"New Caledonia","554":"New Zealand","558":"Nicaragua","562":"Niger","566":"Nigeria","578":"Norway","512":"Oman","586":"Pakistan","591":"Panama","598":"Papua New Guinea","600":"Paraguay","604":"Peru","608":"Philippines","616":"Poland","620":"Portugal","630":"Puerto Rico","634":"Qatar","642":"Romania","643":"Russia","646":"Rwanda","682":"Saudi Arabia","686":"Senegal","688":"Serbia","694":"Sierra Leone","703":"Slovakia","705":"Slovenia","706":"Somalia","710":"South Africa","724":"Spain","144":"Sri Lanka","729":"Sudan","740":"Suriname","748":"Swaziland","752":"Sweden","756":"Switzerland","760":"Syria","762":"Tajikistan","764":"Thailand","768":"Togo","780":"Trinidad and Tobago","788":"Tunisia","792":"Turkey","795":"Turkmenistan","800":"Uganda","804":"Ukraine","784":"United Arab Emirates","826":"United Kingdom","840":"United States of America","858":"Uruguay","860":"Uzbekistan","862":"Venezuela","704":"Vietnam","887":"Yemen","894":"Zambia","716":"Zimbabwe"}
+const NUMERIC_TO_NAME = {"004":"Afghanistan","008":"Albania","012":"Algeria","024":"Angola","032":"Argentina","036":"Australia","040":"Austria","050":"Bangladesh","056":"Belgium","064":"Bhutan","068":"Bolivia","070":"Bosnia and Herzegovina","072":"Botswana","076":"Brazil","100":"Bulgaria","104":"Myanmar","108":"Burundi","112":"Belarus","116":"Cambodia","120":"Cameroon","124":"Canada","140":"Central African Republic","144":"Sri Lanka","148":"Chad","152":"Chile","156":"China","170":"Colombia","178":"Congo","180":"Democratic Republic of the Congo","188":"Costa Rica","191":"Croatia","192":"Cuba","196":"Cyprus","203":"Czech Republic","204":"Benin","208":"Denmark","214":"Dominican Republic","218":"Ecuador","818":"Egypt","222":"El Salvador","226":"Equatorial Guinea","232":"Eritrea","233":"Estonia","231":"Ethiopia","238":"Falkland Islands","246":"Finland","250":"France","266":"Gabon","270":"Gambia","268":"Georgia","276":"Germany","288":"Ghana","300":"Greece","320":"Guatemala","324":"Guinea","328":"Guyana","332":"Haiti","340":"Honduras","348":"Hungary","352":"Iceland","356":"India","360":"Indonesia","364":"Iran","368":"Iraq","372":"Ireland","376":"Israel","380":"Italy","384":"Ivory Coast","388":"Jamaica","392":"Japan","400":"Jordan","398":"Kazakhstan","404":"Kenya","408":"North Korea","410":"South Korea","414":"Kuwait","417":"Kyrgyzstan","418":"Laos","422":"Lebanon","426":"Lesotho","430":"Liberia","434":"Libya","440":"Lithuania","442":"Luxembourg","450":"Madagascar","454":"Malawi","458":"Malaysia","466":"Mali","478":"Mauritania","484":"Mexico","496":"Mongolia","498":"Moldova","504":"Morocco","508":"Mozambique","516":"Namibia","524":"Nepal","528":"Netherlands","540":"New Caledonia","554":"New Zealand","558":"Nicaragua","562":"Niger","566":"Nigeria","578":"Norway","512":"Oman","586":"Pakistan","591":"Panama","598":"Papua New Guinea","600":"Paraguay","604":"Peru","608":"Philippines","616":"Poland","620":"Portugal","630":"Puerto Rico","634":"Qatar","642":"Romania","643":"Russia","646":"Rwanda","682":"Saudi Arabia","686":"Senegal","688":"Serbia","694":"Sierra Leone","703":"Slovakia","705":"Slovenia","706":"Somalia","710":"South Africa","724":"Spain","729":"Sudan","740":"Suriname","748":"Swaziland","752":"Sweden","756":"Switzerland","760":"Syria","762":"Tajikistan","764":"Thailand","768":"Togo","780":"Trinidad and Tobago","788":"Tunisia","792":"Turkey","795":"Turkmenistan","800":"Uganda","804":"Ukraine","784":"United Arab Emirates","826":"United Kingdom","840":"United States of America","858":"Uruguay","860":"Uzbekistan","862":"Venezuela","704":"Vietnam","887":"Yemen","894":"Zambia","716":"Zimbabwe"}

 // Our country names from addresses → match against GeoJSON names
 function isCountryMatch(geoName, visitedCountries) {
--- a/client/src/components/Places/PlaceFormModal.jsx
+++ b/client/src/components/Places/PlaceFormModal.jsx
@@ -3,6 +3,7 @@ import Modal from '../shared/Modal'
 import { mapsApi, tagsApi, categoriesApi } from '../../api/client'
 import { useToast } from '../shared/Toast'
 import { useAuthStore } from '../../store/authStore'
+import { useTranslation } from '../../i18n'
 import { Search, Plus, MapPin, Loader } from 'lucide-react'

 const STATUSES = [
@@ -23,7 +24,8 @@ export default function PlaceFormModal({
  onTagCreated,
 }) {
  const isEditing = !!place
-  const { user } = useAuthStore()
+  const { user, hasMapsKey } = useAuthStore()
+  const { t } = useTranslation()
  const toast = useToast()

  const [categories, setCategories] = useState(initialCategories)
@@ -124,14 +126,17 @@ export default function PlaceFormModal({
    }
  }

+  const [searchSource, setSearchSource] = useState(null)
+
  const handleMapSearch = async () => {
    if (!mapQuery.trim()) return
    setMapSearching(true)
    try {
      const data = await mapsApi.search(mapQuery)
      setMapResults(data.places || [])
+      setSearchSource(data.source || 'google')
    } catch (err) {
-      toast.error(err.response?.data?.error || 'Maps search failed')
+      toast.error(err.response?.data?.error || t('places.mapsSearchError'))
    } finally {
      setMapSearching(false)
    }
@@ -218,9 +223,13 @@ export default function PlaceFormModal({
          </div>
        )}

-        {/* Google Maps search — always visible when API key is set */}
-        {user?.maps_api_key && (
+        {/* Place search — Google Maps or OpenStreetMap fallback */}
          <div className="bg-slate-50 rounded-xl p-3 border border-slate-200">
+            {!hasMapsKey && (
+              <p className="mb-2 text-xs" style={{ color: 'var(--text-faint)' }}>
+                {t('places.osmActive')}
+              </p>
+            )}
            <div className="flex gap-2">
              <div className="relative flex-1">
                <Search className="absolute left-2.5 top-1/2 -translate-y-1/2 w-4 h-4 text-slate-400" />
@@ -229,7 +238,7 @@ export default function PlaceFormModal({
                  value={mapQuery}
                  onChange={e => setMapQuery(e.target.value)}
                  onKeyDown={e => e.key === 'Enter' && handleMapSearch()}
-                  placeholder="Google Maps suchen..."
+                  placeholder={t('places.mapsSearchPlaceholder')}
                  className="w-full pl-8 pr-3 py-2 text-sm border border-slate-200 rounded-lg focus:ring-2 focus:ring-slate-400 focus:border-transparent bg-white"
                />
              </div>
@@ -238,7 +247,7 @@ export default function PlaceFormModal({
                disabled={mapSearching}
                className="px-3 py-2 bg-slate-900 text-white text-sm rounded-lg hover:bg-slate-700 disabled:opacity-50"
              >
-                {mapSearching ? <Loader className="w-4 h-4 animate-spin" /> : 'Suchen'}
+                {mapSearching ? <Loader className="w-4 h-4 animate-spin" /> : t('common.search')}
              </button>
            </div>

@@ -263,7 +272,6 @@ export default function PlaceFormModal({
              </div>
            )}
          </div>
-        )}

        {/* Name */}
        <div>
--- a/client/src/components/Planner/PlaceFormModal.jsx
+++ b/client/src/components/Planner/PlaceFormModal.jsx
@@ -2,6 +2,7 @@ import React, { useState, useEffect } from 'react'
 import Modal from '../shared/Modal'
 import CustomSelect from '../shared/CustomSelect'
 import { mapsApi } from '../../api/client'
+import { useAuthStore } from '../../store/authStore'
 import { useToast } from '../shared/Toast'
 import { Search } from 'lucide-react'
 import { useTranslation } from '../../i18n'
@@ -44,6 +45,7 @@ export default function PlaceFormModal({
  const [isSaving, setIsSaving] = useState(false)
  const toast = useToast()
  const { t, language } = useTranslation()
+  const { hasMapsKey } = useAuthStore()

  useEffect(() => {
    if (place) {
@@ -139,8 +141,13 @@ export default function PlaceFormModal({
      size="lg"
    >
      <form onSubmit={handleSubmit} className="space-y-4">
-        {/* Google Maps Search */}
+        {/* Place Search */}
        <div className="bg-slate-50 rounded-xl p-3 border border-slate-200">
+          {!hasMapsKey && (
+            <p className="mb-2 text-xs" style={{ color: 'var(--text-faint)' }}>
+              {t('places.osmActive')}
+            </p>
+          )}
          <div className="flex gap-2">
            <input
              type="text"
--- a/client/src/i18n/translations/de.js
+++ b/client/src/i18n/translations/de.js
@@ -125,6 +125,22 @@ const de = {
  'settings.email': 'E-Mail',
  'settings.role': 'Rolle',
  'settings.roleAdmin': 'Administrator',
+  'settings.oidcLinked': 'Verknüpft mit',
+  'settings.changePassword': 'Passwort ändern',
+  'settings.currentPassword': 'Aktuelles Passwort',
+  'settings.newPassword': 'Neues Passwort',
+  'settings.confirmPassword': 'Neues Passwort bestätigen',
+  'settings.updatePassword': 'Passwort aktualisieren',
+  'settings.passwordRequired': 'Bitte aktuelles und neues Passwort eingeben',
+  'settings.passwordTooShort': 'Passwort muss mindestens 8 Zeichen lang sein',
+  'settings.passwordMismatch': 'Passwörter stimmen nicht überein',
+  'settings.passwordChanged': 'Passwort erfolgreich geändert',
+  'settings.deleteAccount': 'Account löschen',
+  'settings.deleteAccountTitle': 'Account wirklich löschen?',
+  'settings.deleteAccountWarning': 'Dein Account und alle deine Reisen, Orte und Dateien werden unwiderruflich gelöscht. Diese Aktion kann nicht rückgängig gemacht werden.',
+  'settings.deleteAccountConfirm': 'Endgültig löschen',
+  'settings.deleteBlockedTitle': 'Löschung nicht möglich',
+  'settings.deleteBlockedMessage': 'Du bist der einzige Administrator. Ernenne zuerst einen anderen Benutzer zum Admin, bevor du deinen Account löschen kannst.',
  'settings.roleUser': 'Benutzer',
  'settings.saveProfile': 'Profil speichern',
  'settings.toast.mapSaved': 'Karteneinstellungen gespeichert',
@@ -188,6 +204,7 @@ const de = {
  'admin.table.email': 'E-Mail',
  'admin.table.role': 'Rolle',
  'admin.table.created': 'Erstellt',
+  'admin.table.lastLogin': 'Letzter Login',
  'admin.table.actions': 'Aktionen',
  'admin.you': '(Du)',
  'admin.editUser': 'Benutzer bearbeiten',
@@ -212,12 +229,20 @@ const de = {
  'admin.apiKeys': 'API-Schlüssel',
  'admin.mapsKey': 'Google Maps API Key',
  'admin.mapsKeyHint': 'Für Ortsuche benötigt. Erstellen unter console.cloud.google.com',
+  'admin.mapsKeyHintLong': 'Ohne API Key wird OpenStreetMap für die Ortssuche genutzt. Mit Google API Key können zusätzlich Bilder, Bewertungen und Öffnungszeiten geladen werden. Erstellen unter console.cloud.google.com.',
+  'admin.recommended': 'Empfohlen',
  'admin.weatherKey': 'OpenWeatherMap API Key',
  'admin.weatherKeyHint': 'Für Wetterdaten. Kostenlos unter openweathermap.org',
  'admin.validateKey': 'Test',
  'admin.keyValid': 'Verbunden',
  'admin.keyInvalid': 'Ungültig',
  'admin.keySaved': 'API-Schlüssel gespeichert',
+  'admin.oidcTitle': 'Single Sign-On (OIDC)',
+  'admin.oidcSubtitle': 'Anmeldung über externe Anbieter wie Google, Apple, Authentik oder Keycloak.',
+  'admin.oidcDisplayName': 'Anzeigename',
+  'admin.oidcIssuer': 'Issuer URL',
+  'admin.oidcIssuerHint': 'Die OpenID Connect Issuer URL des Anbieters. z.B. https://accounts.google.com',
+  'admin.oidcSaved': 'OIDC-Konfiguration gespeichert',

  // Trip Planner
  'trip.tabs.plan': 'Planung',
@@ -293,8 +318,10 @@ const de = {
  'places.formNotesPlaceholder': 'Persönliche Notizen...',
  'places.formReservation': 'Reservierung',
  'places.reservationNotesPlaceholder': 'Reservierungsnotizen, Bestätigungsnummer...',
-  'places.mapsSearchPlaceholder': 'Google Maps suchen...',
-  'places.mapsSearchError': 'Google Maps Suche fehlgeschlagen. Bitte API-Schlüssel in den Einstellungen hinterlegen.',
+  'places.mapsSearchPlaceholder': 'Ortssuche...',
+  'places.mapsSearchError': 'Ortssuche fehlgeschlagen.',
+  'places.osmHint': 'OpenStreetMap-Suche aktiv (ohne Bilder, Öffnungszeiten, Bewertungen). Für erweiterte Daten Google API Key in den Einstellungen hinterlegen.',
+  'places.osmActive': 'Suche via OpenStreetMap (ohne Bilder, Bewertungen & Öffnungszeiten). Google API Key in den Einstellungen hinterlegen für erweiterte Daten.',
  'places.categoryCreateError': 'Fehler beim Erstellen der Kategorie',
  'places.nameRequired': 'Bitte einen Namen eingeben',
  'places.saveError': 'Fehler beim Speichern',
--- a/client/src/i18n/translations/en.js
+++ b/client/src/i18n/translations/en.js
@@ -125,6 +125,22 @@ const en = {
  'settings.email': 'Email',
  'settings.role': 'Role',
  'settings.roleAdmin': 'Administrator',
+  'settings.oidcLinked': 'Linked with',
+  'settings.changePassword': 'Change Password',
+  'settings.currentPassword': 'Current password',
+  'settings.newPassword': 'New password',
+  'settings.confirmPassword': 'Confirm new password',
+  'settings.updatePassword': 'Update password',
+  'settings.passwordRequired': 'Please enter current and new password',
+  'settings.passwordTooShort': 'Password must be at least 8 characters',
+  'settings.passwordMismatch': 'Passwords do not match',
+  'settings.passwordChanged': 'Password changed successfully',
+  'settings.deleteAccount': 'Delete account',
+  'settings.deleteAccountTitle': 'Delete your account?',
+  'settings.deleteAccountWarning': 'Your account and all your trips, places, and files will be permanently deleted. This action cannot be undone.',
+  'settings.deleteAccountConfirm': 'Delete permanently',
+  'settings.deleteBlockedTitle': 'Deletion not possible',
+  'settings.deleteBlockedMessage': 'You are the only administrator. Promote another user to admin before deleting your account.',
  'settings.roleUser': 'User',
  'settings.saveProfile': 'Save Profile',
  'settings.toast.mapSaved': 'Map settings saved',
@@ -188,6 +204,7 @@ const en = {
  'admin.table.email': 'Email',
  'admin.table.role': 'Role',
  'admin.table.created': 'Created',
+  'admin.table.lastLogin': 'Last Login',
  'admin.table.actions': 'Actions',
  'admin.you': '(You)',
  'admin.editUser': 'Edit User',
@@ -212,12 +229,20 @@ const en = {
  'admin.apiKeys': 'API Keys',
  'admin.mapsKey': 'Google Maps API Key',
  'admin.mapsKeyHint': 'Required for place search. Get at console.cloud.google.com',
+  'admin.mapsKeyHintLong': 'Without an API key, OpenStreetMap is used for place search. With a Google API key, photos, ratings, and opening hours can be loaded as well. Get one at console.cloud.google.com.',
+  'admin.recommended': 'Recommended',
  'admin.weatherKey': 'OpenWeatherMap API Key',
  'admin.weatherKeyHint': 'For weather data. Free at openweathermap.org',
  'admin.validateKey': 'Test',
  'admin.keyValid': 'Connected',
  'admin.keyInvalid': 'Invalid',
  'admin.keySaved': 'API keys saved',
+  'admin.oidcTitle': 'Single Sign-On (OIDC)',
+  'admin.oidcSubtitle': 'Allow login via external providers like Google, Apple, Authentik or Keycloak.',
+  'admin.oidcDisplayName': 'Display Name',
+  'admin.oidcIssuer': 'Issuer URL',
+  'admin.oidcIssuerHint': 'The OpenID Connect Issuer URL of the provider. e.g. https://accounts.google.com',
+  'admin.oidcSaved': 'OIDC configuration saved',

  // Trip Planner
  'trip.tabs.plan': 'Plan',
@@ -293,8 +318,10 @@ const en = {
  'places.formNotesPlaceholder': 'Personal notes...',
  'places.formReservation': 'Reservation',
  'places.reservationNotesPlaceholder': 'Reservation notes, confirmation number...',
-  'places.mapsSearchPlaceholder': 'Search Google Maps...',
-  'places.mapsSearchError': 'Google Maps search failed. Please add an API key in settings.',
+  'places.mapsSearchPlaceholder': 'Search places...',
+  'places.mapsSearchError': 'Place search failed.',
+  'places.osmHint': 'Using OpenStreetMap search (no photos, opening hours, or ratings). Add a Google API key in settings for full details.',
+  'places.osmActive': 'Search via OpenStreetMap (no photos, ratings or opening hours). Add a Google API key in Settings for enhanced data.',
  'places.categoryCreateError': 'Failed to create category',
  'places.nameRequired': 'Please enter a name',
  'places.saveError': 'Failed to save',
--- a/client/src/pages/AdminPage.jsx
+++ b/client/src/pages/AdminPage.jsx
@@ -2,6 +2,7 @@ import React, { useEffect, useState } from 'react'
 import { useNavigate } from 'react-router-dom'
 import { adminApi, authApi } from '../api/client'
 import { useAuthStore } from '../store/authStore'
+import { useSettingsStore } from '../store/settingsStore'
 import { useTranslation } from '../i18n'
 import Navbar from '../components/Layout/Navbar'
 import Modal from '../components/shared/Modal'
@@ -13,7 +14,8 @@ import CustomSelect from '../components/shared/CustomSelect'

 export default function AdminPage() {
  const { demoMode } = useAuthStore()
-  const { t } = useTranslation()
+  const { t, locale } = useTranslation()
+  const hour12 = useSettingsStore(s => s.settings.time_format) === '12h'
  const TABS = [
    { id: 'users', label: t('admin.tabs.users') },
    { id: 'categories', label: t('admin.tabs.categories') },
@@ -30,6 +32,10 @@ export default function AdminPage() {
  const [showCreateUser, setShowCreateUser] = useState(false)
  const [createForm, setCreateForm] = useState({ username: '', email: '', password: '', role: 'user' })

+  // OIDC config
+  const [oidcConfig, setOidcConfig] = useState({ issuer: '', client_id: '', client_secret: '', display_name: '' })
+  const [savingOidc, setSavingOidc] = useState(false)
+
  // Registration toggle
  const [allowRegistration, setAllowRegistration] = useState(true)

@@ -49,6 +55,7 @@ export default function AdminPage() {
    loadData()
    loadAppConfig()
    loadApiKeys()
+    adminApi.getOidc().then(setOidcConfig).catch(() => {})
  }, [])

  const loadData = async () => {
@@ -238,12 +245,11 @@ export default function AdminPage() {

          {/* Stats */}
          {stats && (
-            <div className="grid grid-cols-2 sm:grid-cols-5 gap-4 mb-6">
+            <div className="grid grid-cols-2 sm:grid-cols-4 gap-4 mb-6">
              {[
                { label: t('admin.stats.users'), value: stats.totalUsers, icon: Users },
                { label: t('admin.stats.trips'), value: stats.totalTrips, icon: Briefcase },
                { label: t('admin.stats.places'), value: stats.totalPlaces, icon: Map },
-                { label: t('admin.stats.photos'), value: stats.totalPhotos || 0, icon: Camera },
                { label: t('admin.stats.files'), value: stats.totalFiles || 0, icon: FileText },
              ].map(({ label, value, icon: Icon }) => (
                <div key={label} className="rounded-xl border p-4" style={{ background: 'var(--bg-card)', borderColor: 'var(--border-primary)' }}>
@@ -303,6 +309,7 @@ export default function AdminPage() {
                        <th className="px-5 py-3">{t('admin.table.email')}</th>
                        <th className="px-5 py-3">{t('admin.table.role')}</th>
                        <th className="px-5 py-3">{t('admin.table.created')}</th>
+                        <th className="px-5 py-3">{t('admin.table.lastLogin')}</th>
                        <th className="px-5 py-3 text-right">{t('admin.table.actions')}</th>
                      </tr>
                    </thead>
@@ -334,7 +341,10 @@ export default function AdminPage() {
                            </span>
                          </td>
                          <td className="px-5 py-3 text-sm text-slate-500">
-                            {new Date(u.created_at).toLocaleDateString('de-DE')}
+                            {new Date(u.created_at).toLocaleDateString(locale)}
+                          </td>
+                          <td className="px-5 py-3 text-sm text-slate-500">
+                            {u.last_login ? new Date(u.last_login).toLocaleDateString(locale, { day: 'numeric', month: 'short', hour: '2-digit', minute: '2-digit', hour12 }) : '—'}
                          </td>
                          <td className="px-5 py-3">
                            <div className="flex items-center gap-2 justify-end">
@@ -403,7 +413,10 @@ export default function AdminPage() {
                <div className="p-6 space-y-4">
                  {/* Google Maps Key */}
                  <div>
-                    <label className="block text-sm font-medium text-slate-700 mb-1.5">{t('admin.mapsKey')}</label>
+                    <label className="flex items-center gap-2 text-sm font-medium text-slate-700 mb-1.5">
+                      {t('admin.mapsKey')}
+                      <span style={{ fontSize: 10, fontWeight: 500, padding: '1px 7px', borderRadius: 99, background: '#dbeafe', color: '#1d4ed8' }}>{t('admin.recommended')}</span>
+                    </label>
                    <div className="flex gap-2">
                      <div className="relative flex-1">
                        <input
@@ -436,7 +449,7 @@ export default function AdminPage() {
                        {t('admin.validateKey')}
                      </button>
                    </div>
-                    <p className="text-xs text-slate-400 mt-1">{t('admin.mapsKeyHint')}</p>
+                    <p className="text-xs text-slate-400 mt-1">{t('admin.mapsKeyHintLong')}</p>
                    {validation.maps === true && (
                      <p className="text-xs text-emerald-600 mt-1 flex items-center gap-1">
                        <span className="w-2 h-2 bg-emerald-500 rounded-full inline-block"></span>
@@ -511,6 +524,73 @@ export default function AdminPage() {
                  </button>
                </div>
              </div>
+
+              {/* OIDC / SSO Configuration */}
+              <div className="bg-white rounded-xl border border-slate-200 overflow-hidden">
+                <div className="px-6 py-4 border-b border-slate-100">
+                  <h2 className="font-semibold text-slate-900">{t('admin.oidcTitle')}</h2>
+                  <p className="text-xs text-slate-400 mt-0.5">{t('admin.oidcSubtitle')}</p>
+                </div>
+                <div className="p-6 space-y-4">
+                  <div>
+                    <label className="block text-sm font-medium text-slate-700 mb-1.5">{t('admin.oidcDisplayName')}</label>
+                    <input
+                      type="text"
+                      value={oidcConfig.display_name}
+                      onChange={e => setOidcConfig(c => ({ ...c, display_name: e.target.value }))}
+                      placeholder='z.B. Google, Authentik, Keycloak'
+                      className="w-full px-3 py-2 border border-slate-300 rounded-lg text-sm focus:ring-2 focus:ring-slate-400 focus:border-transparent"
+                    />
+                  </div>
+                  <div>
+                    <label className="block text-sm font-medium text-slate-700 mb-1.5">{t('admin.oidcIssuer')}</label>
+                    <input
+                      type="url"
+                      value={oidcConfig.issuer}
+                      onChange={e => setOidcConfig(c => ({ ...c, issuer: e.target.value }))}
+                      placeholder='https://accounts.google.com'
+                      className="w-full px-3 py-2 border border-slate-300 rounded-lg text-sm focus:ring-2 focus:ring-slate-400 focus:border-transparent"
+                    />
+                    <p className="text-xs text-slate-400 mt-1">{t('admin.oidcIssuerHint')}</p>
+                  </div>
+                  <div>
+                    <label className="block text-sm font-medium text-slate-700 mb-1.5">Client ID</label>
+                    <input
+                      type="text"
+                      value={oidcConfig.client_id}
+                      onChange={e => setOidcConfig(c => ({ ...c, client_id: e.target.value }))}
+                      className="w-full px-3 py-2 border border-slate-300 rounded-lg text-sm focus:ring-2 focus:ring-slate-400 focus:border-transparent"
+                    />
+                  </div>
+                  <div>
+                    <label className="block text-sm font-medium text-slate-700 mb-1.5">Client Secret</label>
+                    <input
+                      type="password"
+                      value={oidcConfig.client_secret}
+                      onChange={e => setOidcConfig(c => ({ ...c, client_secret: e.target.value }))}
+                      className="w-full px-3 py-2 border border-slate-300 rounded-lg text-sm focus:ring-2 focus:ring-slate-400 focus:border-transparent"
+                    />
+                  </div>
+                  <button
+                    onClick={async () => {
+                      setSavingOidc(true)
+                      try {
+                        await adminApi.updateOidc(oidcConfig)
+                        toast.success(t('admin.oidcSaved'))
+                      } catch (err) {
+                        toast.error(err.response?.data?.error || t('common.error'))
+                      } finally {
+                        setSavingOidc(false)
+                      }
+                    }}
+                    disabled={savingOidc}
+                    className="flex items-center gap-2 px-4 py-2 bg-slate-900 text-white rounded-lg text-sm hover:bg-slate-700 disabled:bg-slate-400"
+                  >
+                    {savingOidc ? <div className="w-4 h-4 border-2 border-white/30 border-t-white rounded-full animate-spin" /> : <Save className="w-4 h-4" />}
+                    {t('common.save')}
+                  </button>
+                </div>
+              </div>
            </div>
          )}

--- a/client/src/pages/LoginPage.jsx
+++ b/client/src/pages/LoginPage.jsx
@@ -4,7 +4,7 @@ import { useAuthStore } from '../store/authStore'
 import { useSettingsStore } from '../store/settingsStore'
 import { useTranslation } from '../i18n'
 import { authApi } from '../api/client'
-import { Plane, Eye, EyeOff, Mail, Lock, MapPin, Calendar, Package, User, Globe, Zap, Users, Wallet, Map, CheckSquare, BookMarked, FolderOpen, Route } from 'lucide-react'
+import { Plane, Eye, EyeOff, Mail, Lock, MapPin, Calendar, Package, User, Globe, Zap, Users, Wallet, Map, CheckSquare, BookMarked, FolderOpen, Route, Shield } from 'lucide-react'

 export default function LoginPage() {
  const { t, language } = useTranslation()
@@ -28,6 +28,28 @@ export default function LoginPage() {
        if (!config.has_users) setMode('register')
      }
    })
+
+    // Handle OIDC callback token
+    const params = new URLSearchParams(window.location.search)
+    const token = params.get('token')
+    const oidcError = params.get('oidc_error')
+    if (token) {
+      localStorage.setItem('auth_token', token)
+      window.history.replaceState({}, '', '/login')
+      login.__fromOidc = true
+      navigate('/dashboard')
+      window.location.reload()
+    }
+    if (oidcError) {
+      const errorMessages = {
+        registration_disabled: language === 'de' ? 'Registrierung ist deaktiviert. Kontaktiere den Administrator.' : 'Registration is disabled. Contact your administrator.',
+        no_email: language === 'de' ? 'Keine E-Mail vom Provider erhalten.' : 'No email received from provider.',
+        token_failed: language === 'de' ? 'Authentifizierung fehlgeschlagen.' : 'Authentication failed.',
+        invalid_state: language === 'de' ? 'Ungueltige Sitzung. Bitte erneut versuchen.' : 'Invalid session. Please try again.',
+      }
+      setError(errorMessages[oidcError] || oidcError)
+      window.history.replaceState({}, '', '/login')
+    }
  }, [])

  const handleDemoLogin = async () => {
@@ -339,6 +361,33 @@ export default function LoginPage() {
            )}
          </div>

+          {/* OIDC / SSO login button */}
+          {appConfig?.oidc_configured && (
+            <>
+              <div style={{ display: 'flex', alignItems: 'center', gap: 12, marginTop: 16 }}>
+                <div style={{ flex: 1, height: 1, background: '#e5e7eb' }} />
+                <span style={{ fontSize: 12, color: '#9ca3af' }}>{language === 'de' ? 'oder' : 'or'}</span>
+                <div style={{ flex: 1, height: 1, background: '#e5e7eb' }} />
+              </div>
+              <a href="/api/auth/oidc/login"
+                style={{
+                  marginTop: 12, width: '100%', padding: '12px',
+                  background: 'white', color: '#374151',
+                  border: '1px solid #d1d5db', borderRadius: 12,
+                  fontSize: 14, fontWeight: 600, cursor: 'pointer',
+                  fontFamily: 'inherit', display: 'flex', alignItems: 'center', justifyContent: 'center', gap: 8,
+                  textDecoration: 'none', transition: 'all 0.15s',
+                  boxSizing: 'border-box',
+                }}
+                onMouseEnter={e => { e.currentTarget.style.background = '#f9fafb'; e.currentTarget.style.borderColor = '#9ca3af' }}
+                onMouseLeave={e => { e.currentTarget.style.background = 'white'; e.currentTarget.style.borderColor = '#d1d5db' }}
+              >
+                <Shield size={16} />
+                {language === 'de' ? `Anmelden mit ${appConfig.oidc_display_name}` : `Sign in with ${appConfig.oidc_display_name}`}
+              </a>
+            </>
+          )}
+
          {/* Demo login button */}
          {appConfig?.demo_mode && (
            <button onClick={handleDemoLogin} disabled={isLoading}
--- a/client/src/pages/SettingsPage.jsx
+++ b/client/src/pages/SettingsPage.jsx
@@ -6,7 +6,8 @@ import { useTranslation } from '../i18n'
 import Navbar from '../components/Layout/Navbar'
 import CustomSelect from '../components/shared/CustomSelect'
 import { useToast } from '../components/shared/Toast'
-import { Save, Map, Palette, User, Moon, Sun, Shield, Camera, Trash2 } from 'lucide-react'
+import { Save, Map, Palette, User, Moon, Sun, Shield, Camera, Trash2, Lock } from 'lucide-react'
+import { authApi, adminApi } from '../api/client'

 const MAP_PRESETS = [
  { name: 'OpenStreetMap', url: 'https://{s}.tile.openstreetmap.org/{z}/{x}/{y}.png' },
@@ -31,7 +32,8 @@ function Section({ title, icon: Icon, children }) {
 }

 export default function SettingsPage() {
-  const { user, updateProfile, uploadAvatar, deleteAvatar } = useAuthStore()
+  const { user, updateProfile, uploadAvatar, deleteAvatar, logout } = useAuthStore()
+  const [showDeleteConfirm, setShowDeleteConfirm] = useState(false)
  const avatarInputRef = React.useRef(null)
  const { settings, updateSetting, updateSettings } = useSettingsStore()
  const { t, locale } = useTranslation()
@@ -52,6 +54,8 @@ export default function SettingsPage() {
  // Account
  const [username, setUsername] = useState(user?.username || '')
  const [email, setEmail] = useState(user?.email || '')
+  const [newPassword, setNewPassword] = useState('')
+  const [confirmPassword, setConfirmPassword] = useState('')

  useEffect(() => {
    setMapTileUrl(settings.map_tile_url || '')
@@ -344,76 +348,244 @@ export default function SettingsPage() {
              />
            </div>

+            {/* Change Password */}
+            <div style={{ paddingTop: 8, marginTop: 8, borderTop: '1px solid var(--border-secondary)' }}>
+              <label className="block text-sm font-medium text-slate-700 mb-3">{t('settings.changePassword')}</label>
+              <div className="space-y-3">
+                <input
+                  type="password"
+                  value={newPassword}
+                  onChange={e => setNewPassword(e.target.value)}
+                  placeholder={t('settings.newPassword')}
+                  className="w-full px-3 py-2 border border-slate-300 rounded-lg text-sm focus:ring-2 focus:ring-slate-400 focus:border-transparent"
+                />
+                <input
+                  type="password"
+                  value={confirmPassword}
+                  onChange={e => setConfirmPassword(e.target.value)}
+                  placeholder={t('settings.confirmPassword')}
+                  className="w-full px-3 py-2 border border-slate-300 rounded-lg text-sm focus:ring-2 focus:ring-slate-400 focus:border-transparent"
+                />
+                <button
+                  onClick={async () => {
+                    if (!newPassword) return toast.error(t('settings.passwordRequired'))
+                    if (newPassword.length < 8) return toast.error(t('settings.passwordTooShort'))
+                    if (newPassword !== confirmPassword) return toast.error(t('settings.passwordMismatch'))
+                    try {
+                      await authApi.changePassword({ new_password: newPassword })
+                      toast.success(t('settings.passwordChanged'))
+                      setNewPassword(''); setConfirmPassword('')
+                    } catch (err) {
+                      toast.error(err.response?.data?.error || t('common.error'))
+                    }
+                  }}
+                  className="flex items-center gap-2 px-4 py-2 rounded-lg text-sm font-medium transition-colors"
+                  style={{ border: '1px solid var(--border-primary)', background: 'var(--bg-card)', color: 'var(--text-secondary)' }}
+                  onMouseEnter={e => e.currentTarget.style.background = 'var(--bg-hover)'}
+                  onMouseLeave={e => e.currentTarget.style.background = 'var(--bg-card)'}
+                >
+                  <Lock size={14} />
+                  {t('settings.updatePassword')}
+                </button>
+              </div>
+            </div>
+
            <div className="flex items-center gap-4">
-              {user?.avatar_url ? (
-                <img src={user.avatar_url} alt="" style={{ width: 64, height: 64, borderRadius: '50%', objectFit: 'cover', flexShrink: 0 }} />
-              ) : (
-                <div style={{
-                  width: 64, height: 64, borderRadius: '50%', flexShrink: 0,
-                  display: 'flex', alignItems: 'center', justifyContent: 'center',
-                  fontSize: 24, fontWeight: 700,
-                  background: 'var(--bg-hover)', color: 'var(--text-secondary)',
-                }}>
-                  {user?.username?.charAt(0).toUpperCase()}
-                </div>
-              )}
-              <div className="flex flex-col gap-2">
+              <div style={{ position: 'relative', flexShrink: 0 }}>
+                {user?.avatar_url ? (
+                  <img src={user.avatar_url} alt="" style={{ width: 64, height: 64, borderRadius: '50%', objectFit: 'cover' }} />
+                ) : (
+                  <div style={{
+                    width: 64, height: 64, borderRadius: '50%',
+                    display: 'flex', alignItems: 'center', justifyContent: 'center',
+                    fontSize: 24, fontWeight: 700,
+                    background: 'var(--bg-hover)', color: 'var(--text-secondary)',
+                  }}>
+                    {user?.username?.charAt(0).toUpperCase()}
+                  </div>
+                )}
+                <input
+                  ref={avatarInputRef}
+                  type="file"
+                  accept="image/*"
+                  onChange={handleAvatarUpload}
+                  style={{ display: 'none' }}
+                />
+                <button
+                  onClick={() => avatarInputRef.current?.click()}
+                  style={{
+                    position: 'absolute', bottom: -3, right: -3,
+                    width: 28, height: 28, borderRadius: '50%',
+                    background: 'var(--text-primary)', color: 'var(--bg-card)',
+                    border: '2px solid var(--bg-card)',
+                    display: 'flex', alignItems: 'center', justifyContent: 'center',
+                    cursor: 'pointer', padding: 0, transition: 'transform 0.15s, opacity 0.15s',
+                  }}
+                  onMouseEnter={e => { e.currentTarget.style.transform = 'scale(1.15)'; e.currentTarget.style.opacity = '0.85' }}
+                  onMouseLeave={e => { e.currentTarget.style.transform = 'scale(1)'; e.currentTarget.style.opacity = '1' }}
+                >
+                  <Camera size={14} />
+                </button>
+                {user?.avatar_url && (
+                  <button
+                    onClick={handleAvatarRemove}
+                    style={{
+                      position: 'absolute', top: -2, right: -2,
+                      width: 20, height: 20, borderRadius: '50%',
+                      background: '#ef4444', color: 'white',
+                      border: '2px solid var(--bg-card)',
+                      display: 'flex', alignItems: 'center', justifyContent: 'center',
+                      cursor: 'pointer', padding: 0,
+                    }}
+                  >
+                    <Trash2 size={10} />
+                  </button>
+                )}
+              </div>
+              <div className="flex flex-col gap-1">
                <div className="text-sm" style={{ color: 'var(--text-muted)' }}>
                  <span className="font-medium" style={{ display: 'inline-flex', alignItems: 'center', gap: 4, color: 'var(--text-secondary)' }}>
                    {user?.role === 'admin' ? <><Shield size={13} /> {t('settings.roleAdmin')}</> : t('settings.roleUser')}
                  </span>
-                </div>
-                <div className="flex items-center gap-2">
-                  <input
-                    ref={avatarInputRef}
-                    type="file"
-                    accept="image/*"
-                    onChange={handleAvatarUpload}
-                    style={{ display: 'none' }}
-                  />
-                  <button
-                    onClick={() => avatarInputRef.current?.click()}
-                    className="flex items-center gap-1.5 px-3 py-1.5 rounded-lg text-xs font-medium transition-colors"
-                    style={{
-                      border: '1px solid var(--border-primary)',
-                      background: 'var(--bg-card)',
-                      color: 'var(--text-secondary)',
-                    }}
-                    onMouseEnter={e => e.currentTarget.style.background = 'var(--bg-hover)'}
-                    onMouseLeave={e => e.currentTarget.style.background = 'var(--bg-card)'}
-                  >
-                    <Camera size={14} />
-                    {t('settings.uploadAvatar')}
-                  </button>
-                  {user?.avatar_url && (
-                    <button
-                      onClick={handleAvatarRemove}
-                      className="flex items-center gap-1.5 px-3 py-1.5 rounded-lg text-xs font-medium transition-colors"
-                      style={{
-                        border: '1px solid var(--border-primary)',
-                        background: 'var(--bg-card)',
-                        color: '#ef4444',
-                      }}
-                      onMouseEnter={e => e.currentTarget.style.background = 'var(--bg-hover)'}
-                      onMouseLeave={e => e.currentTarget.style.background = 'var(--bg-card)'}
-                    >
-                      <Trash2 size={14} />
-                      {t('settings.removeAvatar')}
-                    </button>
+                  {user?.oidc_issuer && (
+                    <span style={{
+                      display: 'inline-flex', alignItems: 'center', gap: 4,
+                      fontSize: 10, fontWeight: 500, padding: '1px 8px', borderRadius: 99,
+                      background: '#dbeafe', color: '#1d4ed8', marginLeft: 6,
+                    }}>
+                      SSO
+                    </span>
                  )}
                </div>
+                {user?.oidc_issuer && (
+                  <p style={{ fontSize: 11, color: 'var(--text-faint)', marginTop: -2 }}>
+                    {t('settings.oidcLinked')} {user.oidc_issuer.replace('https://', '').replace(/\/+$/, '')}
+                  </p>
+                )}
              </div>
            </div>

-            <button
-              onClick={saveProfile}
-              disabled={saving.profile}
-              className="flex items-center gap-2 px-4 py-2 bg-slate-900 text-white rounded-lg text-sm hover:bg-slate-700 disabled:bg-slate-400"
-            >
-              {saving.profile ? <div className="w-4 h-4 border-2 border-white/30 border-t-white rounded-full animate-spin" /> : <Save className="w-4 h-4" />}
-              {t('settings.saveProfile')}
-            </button>
+            <div style={{ display: 'flex', justifyContent: 'space-between', alignItems: 'center', marginTop: 12 }}>
+              <button
+                onClick={saveProfile}
+                disabled={saving.profile}
+                className="flex items-center gap-2 px-4 py-2 bg-slate-900 text-white rounded-lg text-sm hover:bg-slate-700 disabled:bg-slate-400"
+              >
+                {saving.profile ? <div className="w-4 h-4 border-2 border-white/30 border-t-white rounded-full animate-spin" /> : <Save className="w-4 h-4" />}
+                {t('settings.saveProfile')}
+              </button>
+              <button
+                onClick={async () => {
+                  if (user?.role === 'admin') {
+                    try {
+                      const data = await adminApi.stats()
+                      const adminUsers = (await adminApi.users()).users.filter(u => u.role === 'admin')
+                      if (adminUsers.length <= 1) {
+                        setShowDeleteConfirm('blocked')
+                        return
+                      }
+                    } catch {}
+                  }
+                  setShowDeleteConfirm(true)
+                }}
+                className="flex items-center gap-2 px-4 py-2 rounded-lg text-sm font-medium transition-colors text-red-500 hover:bg-red-50"
+                style={{ border: '1px solid #fecaca' }}
+              >
+                <Trash2 size={14} />
+                {t('settings.deleteAccount')}
+              </button>
+            </div>
          </Section>
+
+          {/* Delete Account Confirmation */}
+          {showDeleteConfirm === 'blocked' && (
+            <div style={{
+              position: 'fixed', inset: 0, zIndex: 9999,
+              background: 'rgba(0,0,0,0.5)', backdropFilter: 'blur(4px)',
+              display: 'flex', alignItems: 'center', justifyContent: 'center', padding: 24,
+            }} onClick={() => setShowDeleteConfirm(false)}>
+              <div style={{
+                background: 'var(--bg-card)', borderRadius: 16, padding: '28px 24px',
+                maxWidth: 400, width: '100%', boxShadow: '0 20px 60px rgba(0,0,0,0.3)',
+              }} onClick={e => e.stopPropagation()}>
+                <div style={{ display: 'flex', alignItems: 'center', gap: 10, marginBottom: 16 }}>
+                  <div style={{ width: 36, height: 36, borderRadius: 10, background: '#fef3c7', display: 'flex', alignItems: 'center', justifyContent: 'center' }}>
+                    <Shield size={18} style={{ color: '#d97706' }} />
+                  </div>
+                  <h3 style={{ margin: 0, fontSize: 16, fontWeight: 700, color: 'var(--text-primary)' }}>{t('settings.deleteBlockedTitle')}</h3>
+                </div>
+                <p style={{ fontSize: 13, color: 'var(--text-muted)', lineHeight: 1.6, margin: '0 0 20px' }}>
+                  {t('settings.deleteBlockedMessage')}
+                </p>
+                <div style={{ display: 'flex', justifyContent: 'flex-end' }}>
+                  <button
+                    onClick={() => setShowDeleteConfirm(false)}
+                    style={{
+                      padding: '8px 16px', borderRadius: 8, fontSize: 13, fontWeight: 500,
+                      border: '1px solid var(--border-primary)', background: 'var(--bg-card)', color: 'var(--text-secondary)',
+                      cursor: 'pointer', fontFamily: 'inherit',
+                    }}
+                  >
+                    {t('common.ok') || 'OK'}
+                  </button>
+                </div>
+              </div>
+            </div>
+          )}
+
+          {showDeleteConfirm === true && (
+            <div style={{
+              position: 'fixed', inset: 0, zIndex: 9999,
+              background: 'rgba(0,0,0,0.5)', backdropFilter: 'blur(4px)',
+              display: 'flex', alignItems: 'center', justifyContent: 'center', padding: 24,
+            }} onClick={() => setShowDeleteConfirm(false)}>
+              <div style={{
+                background: 'var(--bg-card)', borderRadius: 16, padding: '28px 24px',
+                maxWidth: 400, width: '100%', boxShadow: '0 20px 60px rgba(0,0,0,0.3)',
+              }} onClick={e => e.stopPropagation()}>
+                <div style={{ display: 'flex', alignItems: 'center', gap: 10, marginBottom: 16 }}>
+                  <div style={{ width: 36, height: 36, borderRadius: 10, background: '#fef2f2', display: 'flex', alignItems: 'center', justifyContent: 'center' }}>
+                    <Trash2 size={18} style={{ color: '#ef4444' }} />
+                  </div>
+                  <h3 style={{ margin: 0, fontSize: 16, fontWeight: 700, color: 'var(--text-primary)' }}>{t('settings.deleteAccountTitle')}</h3>
+                </div>
+                <p style={{ fontSize: 13, color: 'var(--text-muted)', lineHeight: 1.6, margin: '0 0 20px' }}>
+                  {t('settings.deleteAccountWarning')}
+                </p>
+                <div style={{ display: 'flex', justifyContent: 'flex-end', gap: 8 }}>
+                  <button
+                    onClick={() => setShowDeleteConfirm(false)}
+                    style={{
+                      padding: '8px 16px', borderRadius: 8, fontSize: 13, fontWeight: 500,
+                      border: '1px solid var(--border-primary)', background: 'var(--bg-card)', color: 'var(--text-secondary)',
+                      cursor: 'pointer', fontFamily: 'inherit',
+                    }}
+                  >
+                    {t('common.cancel')}
+                  </button>
+                  <button
+                    onClick={async () => {
+                      try {
+                        await authApi.deleteOwnAccount()
+                        logout()
+                        navigate('/login')
+                      } catch (err) {
+                        toast.error(err.response?.data?.error || t('common.error'))
+                        setShowDeleteConfirm(false)
+                      }
+                    }}
+                    style={{
+                      padding: '8px 16px', borderRadius: 8, fontSize: 13, fontWeight: 600,
+                      border: 'none', background: '#ef4444', color: 'white',
+                      cursor: 'pointer', fontFamily: 'inherit',
+                    }}
+                  >
+                    {t('settings.deleteAccountConfirm')}
+                  </button>
+                </div>
+              </div>
+            </div>
+          )}
        </div>
      </div>
    </div>
--- a/client/src/store/authStore.js
+++ b/client/src/store/authStore.js
@@ -9,6 +9,7 @@ export const useAuthStore = create((set, get) => ({
  isLoading: false,
  error: null,
  demoMode: localStorage.getItem('demo_mode') === 'true',
+  hasMapsKey: false,

  login: async (email, password) => {
    set({ isLoading: true, error: null })
@@ -137,6 +138,8 @@ export const useAuthStore = create((set, get) => ({
    set({ demoMode: val })
  },

+  setHasMapsKey: (val) => set({ hasMapsKey: val }),
+
  demoLogin: async () => {
    set({ isLoading: true, error: null })
    try {
--- a/server/package-lock.json
+++ b/server/package-lock.json
@@ -1,12 +1,12 @@
 {
  "name": "nomad-server",
-  "version": "2.0.0",
+  "version": "2.3.4",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "nomad-server",
-      "version": "2.0.0",
+      "version": "2.3.4",
      "dependencies": {
        "archiver": "^6.0.1",
        "bcryptjs": "^2.4.3",
--- a/server/package.json
+++ b/server/package.json
@@ -1,6 +1,6 @@
 {
  "name": "nomad-server",
-  "version": "2.3.5",
+  "version": "2.4.0",
  "main": "src/index.js",
  "scripts": {
    "start": "node --experimental-sqlite src/index.js",
--- a/server/src/db/database.js
+++ b/server/src/db/database.js
@@ -250,6 +250,9 @@ function initDb() {
    `ALTER TABLE trips ADD COLUMN is_archived INTEGER DEFAULT 0`,
    `ALTER TABLE categories ADD COLUMN user_id INTEGER REFERENCES users(id) ON DELETE SET NULL`,
    `ALTER TABLE users ADD COLUMN avatar TEXT`,
+    `ALTER TABLE users ADD COLUMN oidc_sub TEXT`,
+    `ALTER TABLE users ADD COLUMN oidc_issuer TEXT`,
+    `ALTER TABLE users ADD COLUMN last_login DATETIME`,
  ];

  // Recreate budget_items to allow NULL persons (SQLite can't ALTER NOT NULL)
--- a/server/src/index.js
+++ b/server/src/index.js
@@ -76,7 +76,9 @@ const settingsRoutes = require('./routes/settings');
 const budgetRoutes = require('./routes/budget');
 const backupRoutes = require('./routes/backup');

+const oidcRoutes = require('./routes/oidc');
 app.use('/api/auth', authRoutes);
+app.use('/api/auth/oidc', oidcRoutes);
 app.use('/api/trips', tripsRoutes);
 app.use('/api/trips/:tripId/days', daysRoutes);
 app.use('/api/trips/:tripId/places', placesRoutes);
--- a/server/src/routes/admin.js
+++ b/server/src/routes/admin.js
@@ -11,7 +11,7 @@ router.use(authenticate, adminOnly);
 // GET /api/admin/users
 router.get('/users', (req, res) => {
  const users = db.prepare(
-    'SELECT id, username, email, role, created_at, updated_at FROM users ORDER BY created_at DESC'
+    'SELECT id, username, email, role, created_at, updated_at, last_login FROM users ORDER BY created_at DESC'
  ).all();
  res.json({ users });
 });
@@ -104,10 +104,31 @@ router.get('/stats', (req, res) => {
  const totalUsers = db.prepare('SELECT COUNT(*) as count FROM users').get().count;
  const totalTrips = db.prepare('SELECT COUNT(*) as count FROM trips').get().count;
  const totalPlaces = db.prepare('SELECT COUNT(*) as count FROM places').get().count;
-  const totalPhotos = db.prepare('SELECT COUNT(*) as count FROM photos').get().count;
  const totalFiles = db.prepare('SELECT COUNT(*) as count FROM trip_files').get().count;

-  res.json({ totalUsers, totalTrips, totalPlaces, totalPhotos, totalFiles });
+  res.json({ totalUsers, totalTrips, totalPlaces, totalFiles });
+});
+
+// GET /api/admin/oidc — get OIDC config
+router.get('/oidc', (req, res) => {
+  const get = (key) => db.prepare("SELECT value FROM app_settings WHERE key = ?").get(key)?.value || '';
+  res.json({
+    issuer: get('oidc_issuer'),
+    client_id: get('oidc_client_id'),
+    client_secret: get('oidc_client_secret'),
+    display_name: get('oidc_display_name'),
+  });
+});
+
+// PUT /api/admin/oidc — update OIDC config
+router.put('/oidc', (req, res) => {
+  const { issuer, client_id, client_secret, display_name } = req.body;
+  const set = (key, val) => db.prepare("INSERT OR REPLACE INTO app_settings (key, value) VALUES (?, ?)").run(key, val || '');
+  set('oidc_issuer', issuer);
+  set('oidc_client_id', client_id);
+  set('oidc_client_secret', client_secret);
+  set('oidc_display_name', display_name);
+  res.json({ success: true });
 });

 // POST /api/admin/save-demo-baseline (demo mode only)
--- a/server/src/routes/auth.js
+++ b/server/src/routes/auth.js
@@ -67,10 +67,19 @@ router.get('/app-config', (req, res) => {
  const allowRegistration = userCount === 0 || (setting?.value ?? 'true') === 'true';
  const isDemo = process.env.DEMO_MODE === 'true';
  const { version } = require('../../package.json');
+  const hasGoogleKey = !!db.prepare("SELECT maps_api_key FROM users WHERE role = 'admin' AND maps_api_key IS NOT NULL AND maps_api_key != '' LIMIT 1").get();
+  const oidcDisplayName = db.prepare("SELECT value FROM app_settings WHERE key = 'oidc_display_name'").get()?.value || null;
+  const oidcConfigured = !!(
+    db.prepare("SELECT value FROM app_settings WHERE key = 'oidc_issuer'").get()?.value &&
+    db.prepare("SELECT value FROM app_settings WHERE key = 'oidc_client_id'").get()?.value
+  );
  res.json({
    allow_registration: isDemo ? false : allowRegistration,
    has_users: userCount > 0,
    version,
+    has_maps_key: hasGoogleKey,
+    oidc_configured: oidcConfigured,
+    oidc_display_name: oidcConfigured ? (oidcDisplayName || 'SSO') : undefined,
    demo_mode: isDemo,
    demo_email: isDemo ? 'demo@nomad.app' : undefined,
    demo_password: isDemo ? 'demo12345' : undefined,
@@ -158,6 +167,7 @@ router.post('/login', authLimiter, (req, res) => {
    return res.status(401).json({ error: 'Ungültige E-Mail oder Passwort' });
  }

+  db.prepare('UPDATE users SET last_login = CURRENT_TIMESTAMP WHERE id = ?').run(user.id);
  const token = generateToken(user);
  const { password_hash, maps_api_key, openweather_api_key, unsplash_api_key, ...userWithoutSensitive } = user;

@@ -167,7 +177,7 @@ router.post('/login', authLimiter, (req, res) => {
 // GET /api/auth/me
 router.get('/me', authenticate, (req, res) => {
  const user = db.prepare(
-    'SELECT id, username, email, role, avatar, created_at FROM users WHERE id = ?'
+    'SELECT id, username, email, role, avatar, oidc_issuer, created_at FROM users WHERE id = ?'
  ).get(req.user.id);

  if (!user) {
@@ -177,6 +187,30 @@ router.get('/me', authenticate, (req, res) => {
  res.json({ user: { ...user, avatar_url: avatarUrl(user) } });
 });

+// PUT /api/auth/me/password
+router.put('/me/password', authenticate, (req, res) => {
+  const { new_password } = req.body;
+  if (!new_password) return res.status(400).json({ error: 'New password is required' });
+  if (new_password.length < 8) return res.status(400).json({ error: 'Password must be at least 8 characters' });
+
+  const hash = bcrypt.hashSync(new_password, 10);
+  db.prepare('UPDATE users SET password_hash = ?, updated_at = CURRENT_TIMESTAMP WHERE id = ?').run(hash, req.user.id);
+  res.json({ success: true });
+});
+
+// DELETE /api/auth/me — delete own account
+router.delete('/me', authenticate, (req, res) => {
+  // Prevent deleting last admin
+  if (req.user.role === 'admin') {
+    const adminCount = db.prepare("SELECT COUNT(*) as count FROM users WHERE role = 'admin'").get().count;
+    if (adminCount <= 1) {
+      return res.status(400).json({ error: 'Cannot delete the last admin account' });
+    }
+  }
+  db.prepare('DELETE FROM users WHERE id = ?').run(req.user.id);
+  res.json({ success: true });
+});
+
 // PUT /api/auth/me/maps-key
 router.put('/me/maps-key', authenticate, (req, res) => {
  const { maps_api_key } = req.body;
--- a/server/src/routes/maps.js
+++ b/server/src/routes/maps.js
@@ -17,6 +17,34 @@ function getMapsKey(userId) {
 const photoCache = new Map();
 const PHOTO_TTL = 12 * 60 * 60 * 1000; // 12 hours

+// Nominatim search (OpenStreetMap) — free fallback when no Google API key
+async function searchNominatim(query, lang) {
+  const params = new URLSearchParams({
+    q: query,
+    format: 'json',
+    addressdetails: '1',
+    limit: '10',
+    'accept-language': lang || 'en',
+  });
+  const response = await fetch(`https://nominatim.openstreetmap.org/search?${params}`, {
+    headers: { 'User-Agent': 'NOMAD Travel Planner (https://github.com/mauriceboe/NOMAD)' },
+  });
+  if (!response.ok) throw new Error('Nominatim API error');
+  const data = await response.json();
+  return data.map(item => ({
+    google_place_id: null,
+    osm_id: `${item.osm_type}/${item.osm_id}`,
+    name: item.name || item.display_name?.split(',')[0] || '',
+    address: item.display_name || '',
+    lat: parseFloat(item.lat) || null,
+    lng: parseFloat(item.lon) || null,
+    rating: null,
+    website: null,
+    phone: null,
+    source: 'openstreetmap',
+  }));
+}
+
 // POST /api/maps/search
 router.post('/search', authenticate, async (req, res) => {
  const { query } = req.body;
@@ -24,8 +52,16 @@ router.post('/search', authenticate, async (req, res) => {
  if (!query) return res.status(400).json({ error: 'Suchanfrage ist erforderlich' });

  const apiKey = getMapsKey(req.user.id);
+
+  // No Google API key → use Nominatim (OpenStreetMap)
  if (!apiKey) {
-    return res.status(400).json({ error: 'Google Maps API-Schlüssel nicht konfiguriert. Bitte in den Einstellungen hinzufügen.' });
+    try {
+      const places = await searchNominatim(query, req.query.lang);
+      return res.json({ places, source: 'openstreetmap' });
+    } catch (err) {
+      console.error('Nominatim search error:', err);
+      return res.status(500).json({ error: 'Fehler bei der OpenStreetMap Suche' });
+    }
  }

  try {
@@ -54,9 +90,10 @@ router.post('/search', authenticate, async (req, res) => {
      rating: p.rating || null,
      website: p.websiteUri || null,
      phone: p.nationalPhoneNumber || null,
+      source: 'google',
    }));

-    res.json({ places });
+    res.json({ places, source: 'google' });
  } catch (err) {
    console.error('Maps search error:', err);
    res.status(500).json({ error: 'Fehler bei der Google Places Suche' });
--- a/server/src/routes/oidc.js
+++ b/server/src/routes/oidc.js
@@ -0,0 +1,206 @@
+const express = require('express');
+const crypto = require('crypto');
+const fetch = require('node-fetch');
+const jwt = require('jsonwebtoken');
+const { db } = require('../db/database');
+const { JWT_SECRET } = require('../config');
+
+const router = express.Router();
+
+// In-memory state store for CSRF protection (state → { createdAt, redirectUri })
+const pendingStates = new Map();
+const STATE_TTL = 5 * 60 * 1000; // 5 minutes
+
+// Cleanup expired states periodically
+setInterval(() => {
+  const now = Date.now();
+  for (const [state, data] of pendingStates) {
+    if (now - data.createdAt > STATE_TTL) pendingStates.delete(state);
+  }
+}, 60 * 1000);
+
+// Read OIDC config from app_settings
+function getOidcConfig() {
+  const get = (key) => db.prepare("SELECT value FROM app_settings WHERE key = ?").get(key)?.value || null;
+  const issuer = get('oidc_issuer');
+  const clientId = get('oidc_client_id');
+  const clientSecret = get('oidc_client_secret');
+  const displayName = get('oidc_display_name') || 'SSO';
+  if (!issuer || !clientId || !clientSecret) return null;
+  return { issuer: issuer.replace(/\/+$/, ''), clientId, clientSecret, displayName };
+}
+
+// Cache discovery document
+let discoveryCache = null;
+let discoveryCacheTime = 0;
+const DISCOVERY_TTL = 60 * 60 * 1000; // 1 hour
+
+async function discover(issuer) {
+  if (discoveryCache && Date.now() - discoveryCacheTime < DISCOVERY_TTL && discoveryCache._issuer === issuer) {
+    return discoveryCache;
+  }
+  const res = await fetch(`${issuer}/.well-known/openid-configuration`);
+  if (!res.ok) throw new Error('Failed to fetch OIDC discovery document');
+  const doc = await res.json();
+  doc._issuer = issuer;
+  discoveryCache = doc;
+  discoveryCacheTime = Date.now();
+  return doc;
+}
+
+function generateToken(user) {
+  return jwt.sign(
+    { id: user.id, username: user.username, email: user.email, role: user.role },
+    JWT_SECRET,
+    { expiresIn: '24h' }
+  );
+}
+
+function frontendUrl(path) {
+  const base = process.env.NODE_ENV === 'production' ? '' : 'http://localhost:5173';
+  return base + path;
+}
+
+// GET /api/auth/oidc/login — redirect to OIDC provider
+router.get('/login', async (req, res) => {
+  const config = getOidcConfig();
+  if (!config) return res.status(400).json({ error: 'OIDC not configured' });
+
+  try {
+    const doc = await discover(config.issuer);
+    const state = crypto.randomBytes(32).toString('hex');
+    const proto = req.headers['x-forwarded-proto'] || req.protocol;
+    const host = req.headers['x-forwarded-host'] || req.headers.host;
+    const redirectUri = `${proto}://${host}/api/auth/oidc/callback`;
+
+    pendingStates.set(state, { createdAt: Date.now(), redirectUri });
+
+    const params = new URLSearchParams({
+      response_type: 'code',
+      client_id: config.clientId,
+      redirect_uri: redirectUri,
+      scope: 'openid email profile',
+      state,
+    });
+
+    res.redirect(`${doc.authorization_endpoint}?${params}`);
+  } catch (err) {
+    console.error('[OIDC] Login error:', err.message);
+    res.status(500).json({ error: 'OIDC login failed' });
+  }
+});
+
+// GET /api/auth/oidc/callback — handle provider callback
+router.get('/callback', async (req, res) => {
+  const { code, state, error: oidcError } = req.query;
+
+  if (oidcError) {
+    console.error('[OIDC] Provider error:', oidcError);
+    return res.redirect(frontendUrl('/login?oidc_error=' + encodeURIComponent(oidcError)));
+  }
+
+  if (!code || !state) {
+    return res.redirect(frontendUrl('/login?oidc_error=missing_params'));
+  }
+
+  const pending = pendingStates.get(state);
+  if (!pending) {
+    return res.redirect(frontendUrl('/login?oidc_error=invalid_state'));
+  }
+  pendingStates.delete(state);
+
+  const config = getOidcConfig();
+  if (!config) return res.redirect(frontendUrl('/login?oidc_error=not_configured'));
+
+  try {
+    const doc = await discover(config.issuer);
+
+    // Exchange code for tokens
+    const tokenRes = await fetch(doc.token_endpoint, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+      body: new URLSearchParams({
+        grant_type: 'authorization_code',
+        code,
+        redirect_uri: pending.redirectUri,
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+      }),
+    });
+
+    const tokenData = await tokenRes.json();
+    if (!tokenRes.ok || !tokenData.access_token) {
+      console.error('[OIDC] Token exchange failed:', tokenData);
+      return res.redirect(frontendUrl('/login?oidc_error=token_failed'));
+    }
+
+    // Get user info
+    const userInfoRes = await fetch(doc.userinfo_endpoint, {
+      headers: { Authorization: `Bearer ${tokenData.access_token}` },
+    });
+    const userInfo = await userInfoRes.json();
+
+    if (!userInfo.email) {
+      return res.redirect(frontendUrl('/login?oidc_error=no_email'));
+    }
+
+    const email = userInfo.email.toLowerCase();
+    const name = userInfo.name || userInfo.preferred_username || email.split('@')[0];
+    const sub = userInfo.sub;
+
+    // Find existing user by OIDC sub or email
+    let user = db.prepare('SELECT * FROM users WHERE oidc_sub = ? AND oidc_issuer = ?').get(sub, config.issuer);
+    if (!user) {
+      user = db.prepare('SELECT * FROM users WHERE LOWER(email) = ?').get(email);
+    }
+
+    if (user) {
+      // Existing user — link OIDC if not already linked
+      if (!user.oidc_sub) {
+        db.prepare('UPDATE users SET oidc_sub = ?, oidc_issuer = ? WHERE id = ?').run(sub, config.issuer, user.id);
+      }
+    } else {
+      // New user — check if registration is allowed
+      const userCount = db.prepare('SELECT COUNT(*) as count FROM users').get().count;
+      const isFirstUser = userCount === 0;
+
+      if (!isFirstUser) {
+        const setting = db.prepare("SELECT value FROM app_settings WHERE key = 'allow_registration'").get();
+        if (setting?.value === 'false') {
+          return res.redirect(frontendUrl('/login?oidc_error=registration_disabled'));
+        }
+      }
+
+      // Create user (first user = admin)
+      const role = isFirstUser ? 'admin' : 'user';
+      // Generate a random password hash (user won't use password login)
+      const randomPass = crypto.randomBytes(32).toString('hex');
+      const bcrypt = require('bcryptjs');
+      const hash = bcrypt.hashSync(randomPass, 10);
+
+      // Ensure unique username
+      let username = name.replace(/[^a-zA-Z0-9_-]/g, '').substring(0, 30) || 'user';
+      const existing = db.prepare('SELECT id FROM users WHERE LOWER(username) = LOWER(?)').get(username);
+      if (existing) username = `${username}_${Date.now() % 10000}`;
+
+      const result = db.prepare(
+        'INSERT INTO users (username, email, password_hash, role, oidc_sub, oidc_issuer) VALUES (?, ?, ?, ?, ?, ?)'
+      ).run(username, email, hash, role, sub, config.issuer);
+
+      user = { id: Number(result.lastInsertRowid), username, email, role };
+    }
+
+    // Update last login
+    db.prepare('UPDATE users SET last_login = CURRENT_TIMESTAMP WHERE id = ?').run(user.id);
+
+    // Generate JWT and redirect to frontend
+    const token = generateToken(user);
+    // In dev mode, frontend runs on a different port
+    res.redirect(frontendUrl(`/login?token=${token}`));
+  } catch (err) {
+    console.error('[OIDC] Callback error:', err);
+    res.redirect(frontendUrl('/login?oidc_error=server_error'));
+  }
+});
+
+module.exports = router;